NefMoto

Technical => Reverse Engineering => Topic started by: masterj on September 10, 2014, 08:44:36 AM



Title: Almost tracked rkukg_w but not sure :)
Post by: masterj on September 10, 2014, 08:44:36 AM
Guys, anyone remembers how rkukg_w looks in gk when disassembled?

Please check out attached image... I kinda suspect either word_FE0E or word_FE0C


Title: Re: Almost tracked rkukg_w but not sure :)
Post by: elRey on September 10, 2014, 12:15:05 PM
Right out of view above what you showed (the very next grouping) you'll find two mov

mov r4, word_38xxx1 ;fra_w
mov r5, word_38xxx2 ;rkukg_w
jmpr cc_N, loc_86xxxx



The second mov is your rkukg_w


That memory location should xference to only two functions (GK, and ESUK).


What you have circled in red is fra_w being mul to the result after rkukg_w has being added (top boxes in your img). fra_w is the other var  in the grouping I mentioned above.


Title: Re: Almost tracked rkukg_w but not sure :)
Post by: masterj on September 10, 2014, 12:49:54 PM
Right out of view above what you showed (the very next grouping) you'll find two mov

mov r4, word_38xxx1 ;fra_w
mov r5, word_38xxx2 ;rkukg_w
jmpr cc_N, loc_86xxxx



The second mov is your rkukg_w


That memory location should xference to only two functions (GK, and ESUK).


What you have circled in red is fra_w being mul to the result after rkukg_w has being added (top boxes in your img). fra_w is the other var  in the grouping I mentioned above.

thanks very much!